https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:52:27.093763+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-370448 EUVD-2026-370448 2026-10-05T18:52:27.140640+00:00 EUVD-2026-370448 https://cve.radiocsirt.org/vuln/fkie_cve-2026-92586 fkie_cve-2026-92586 2026-10-05T18:52:27.140681+00:00

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.

 https://cve.radiocsirt.org/vuln/ghsa-2vmx-78wc-x2hc GHSA-2vmx-78wc-x2hc 2026-10-05T18:52:27.140715+00:00

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.